Dashboards & Visualizations

How do I populate a multivalue input with itself during a drilldown?

thisissplunk
Builder

I have a few inputs at the top of my dashboard, one being a multivalue input. Its default is two values, but I often only have one value in there to filter the result show I'd like.

I then click on a field value in a random panel that reloads the dashboard page with the new selected data filtering the entire dashboard. However, this resets the multivalue input back to default. This is not what I want. I've tried this and it places values into the multivalue input instead, but incorrectly so, returning no results:

 <link field="filename">
            <![CDATA[
              /app/Splunk_Files_App/filedata_dashboard?form.filename=$click.value2$&form.index=$index$&form.filetype=$filetype$
            ]]>
 </link>

The problem is the multivalue $filetype$. It literally populates it with "file_type=exe" when I drilldown instead of "EXE".
Here is the multivalue input if needed:

<input type="multiselect" token="filetype" searchWhenChanged="true">
  <label>File name</label>
  <choice value="*">All</choice>
  <default>EXE,PDF</default>
  <search>
    <query>index=$index$ sourcetype=file_data | dedup file_type | table file_type</query>
    <earliest>$time.earliest$</earliest>
    <latest>$time.latest$</latest>
  </search>
  <fieldForLabel>file_type</fieldForLabel>
  <fieldForValue>file_type</fieldForValue>
  <!--      Build multi-selection search: 
  EX: (sourcetype ="value1" OR sourcetype ="value2" OR ...)
  -->
  <prefix>(</prefix>
  <valuePrefix>file_type="</valuePrefix>
  <valueSuffix>"</valueSuffix>
  <delimiter> OR </delimiter>
  <suffix>)</suffix>
</input>

tldr: I try to populate a multivalue input with itself during a drilldown and it doesn't work as expected. How do I do this?

somesoni2
Revered Legend

Try something like this (run anywhere example). See how the multiselect values are formatted (just with delimiter) and how they are used in the search (using subsearch to generate field=value1 OR field=value2... format)

<form>
  <label>Multiselect Dropdown</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="sourcetype" searchWhenChanged="true">
      <label>Source Types</label>
      <choice value="splunkd">splunkd</choice>
      <choice value="splunk_web_access">splunk_web_access</choice>
      <choice value="scheduler">scheduler</choice>
      <default>splunkd,splunk_web_access</default>
      <delimiter>,</delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Sourcetype Distribution</title>
        <search>
          <query>index=_internal [| gentimes start=-1 | eval sourcetype="$sourcetype$" | table sourcetype | makemv sourcetype delim="," | mvexpand sourcetype ]| timechart count by sourcetype</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>

        <option name="charting.legend.placement">right</option>
        <drilldown>
          <link>
            <![CDATA[
               /app/search/multiselect_dropdown?form.sourcetype=$click.name2$
             ]]>
          </link>
        </drilldown>        
      </chart>
    </panel>
  </row>
</form>
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...